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DATA PROTECTI ON ACT 1998 


SUPERVISORY POWERS OF THE INFORMATION COMMISSIONER 


ENFORCEMENT NOTI CE 


Studios MG Limited 


3 Shortlands, Shortlands, Hammersmith, London W6 8DA 


The Information Commissioner (“Commissioner”) has decided to issue 
Studios MG Limited (“SMG”) with an enforcement notice under section 
40 of the Data Protection Act 1998 (“DPA”). The Notice is in relation to 
a serious contravention of Regulation 22 of the Privacy and Electronic 

Communications (EC Directive) Regulations 2003 (“PECR”). 


This notice explains the Commissioner’s decision. 


Legal framework 


SMG, whose registered office is given above (Companies House 
Registration Number: 09417715) is the organisation stated in this 
notice to have transmitted unsolicited communications by means of 
electronic mail to individual subscribers for the purposes of direct 


marketing contrary to regulation 22 of PECR. 


Regulation 22 of PECR states: 


© 
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“(1) This regulation applies to the transmission of unsolicited 


communications by means of electronic mail to individual 


subscribers. 


(2) Except in the circumstances referred to in paragraph (3), a person 
shall neither transmit, nor instigate the transmission of, unsolicited 
communications for the purposes of direct marketing by means of 
electronic mail unless the recipient of the electronic mail has 
previously notified the sender that he consents for the time being 
to such communications being sent by, or at the instigation of, the 


sender. 


(3) A person may send or instigate the sending of electronic mail for 


the purposes of direct marketing where— 


(a) that person has obtained the contact details of the recipient 
of that electronic mail in the course of the sale or 
negotiations for the sale of a product or service to that 


recipient; 


(b) the direct marketing is in respect of that person’s similar 


products and services only; and 


(c) the recipient has been given a simple means of refusing 
(free of charge except for the costs of the transmission of 
the refusal) the use of his contact details for the purposes 
of such direct marketing, at the time that the details were 
initially collected, and, where he did not initially refuse the 
use of the details, at the time of each subsequent 


communication. 


(4) A subscriber shall not permit his line to be used in contravention of 


paragraph (2).” 
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“(3) A person may send or instigate the sending of electronic mail for 


the purposes of direct marketing where— 


(a) that person has obtained the contact details of the recipient 
of that electronic mail in the course of the sale or 
negotiations for the sale of a product or service to that 


recipient; 


(b) the direct marketing is in respect of that person’s similar 


products and services only; and 


(c) the recipient has been given a simple means of refusing 
(free of charge except for the costs of the transmission of 
the refusal) the use of his contact details for the purposes 
of such direct marketing, at the time that the details were 
initially collected, and, where he did not initially refuse the 
use of the details, at the time of each subsequent 


communication. 


Section 11(3) of the DPA defines “direct marketing” as “the 
communication (by whatever means) of any advertising or marketing 
material which is directed to particular individuals”. This definition also 


applies for the purposes of PECR (see regulation 2(2)) 


Consent is defined in the European Directive 95/46/EC as “any freely 
given specific and informed indication of his wishes by which the data 
Subject signifies his agreement to personal data relating to him being 
processed”. 


“Individual” is defined in regulation 2(1) of PECR as “a living individual 


and includes an unincorporated body of such individuals”. 
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A “subscriber” is defined in regulation 2(1) of PECR as “a person who is 


a party to a contract with a provider of public electronic 


communications services for the supply of such services”. 


“Electronic mail’ is defined in regulation 2(1) of PECR as “any text, 
voice, sound or image message sent over a public electronic 
communications network which can be stored in the network or in the 
recipient’s terminal equipment until it is collected by the recipient and 


includes messages sent using a short message service”. 


PECR implements European legislation (Directive 2002/58/EC) aimed at 
the protection of the individual’s fundamental right to privacy in the 
electronic communications sector. PECR was amended for the purpose 
of giving effect to Directive 2009/136/EC which amended and 
strengthened the 2002 provisions. The Commissioner approaches PECR 


so as to give effect to the Directives. 


The DPA contains enforcement provisions at Part V which are 
exercisable by the Commissioner. Those provisions are modified and 
extended for the purposes of PECR by Schedule 1 PECR. 


Section 40(1)(a) of the DPA (as extended and modified by PECR) 
provides that if the Commissioner is satisfied that a person has 
contravened or is contravening any of the requirements of the 
Regulations, she may serve him with an Enforcement Notice requiring 
him to take within such time as may be specified in the Notice, or to 
refrain from taking after such time as may be so specified, such steps 


as are So specified. 


The provisions of the DPA remain in force for the purposes of PECR 
notwithstanding the introduction of the Data Protection Act 2018 (see 
paragraph 58(1) of Part 9, Schedule 20 of that Act). 


4 


15. 


16. 


17. 


18. 


19. 


20. 


21. 


1CO. 


Information Commissioner's Office 


The contravention 
The Commissioner finds that SMG contravened regulation 22 of PECR. 
The Commissioner finds that the contravention was as follows: 


The Commissioner finds that on 30 April 2020 there was one direct 
marketing email received by a subscriber, capable of being evidenced 
by a complaint. The Commissioner finds that SMG transmitted the 


direct marketing message, contrary to regulation 22 of PECR. 


SMG has confirmed however that between 8,000 to 9,000 such direct 
marketing emails were sent on 30 April 2020, but has failed to provide 
precise figures for those direct marketing messages that were received 
by subscribers. 


SMG, as the sender of the direct marketing, is required to ensure that 
it is acting in compliance with the requirements of regulation 22 of 
PECR, and to ensure that valid consent to send those messages had 


been acquired. 


In this instance SMG has stated only that it does not hold any evidence 
of consent for the individuals to whom it engaged in its one-day direct 


marketing campaign. 


SMG has indicated that the data it used had been gathered over a 
number of years from various sources, including but not limited to 
“LinkedIn connections, events, [and] people who had emailed [the 
director]”. It is apparent to the Commissioner that SMG’s direct 
marketing campaign was therefore made possible by using data which 


had been scraped from various vaguely defined sources. SMG made no 
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apparent effort to obtain consent for the direct marketing that it sent 
on 30 April 2020, and indeed it would appear from the account given 
by the complainant in this instance that data could have been 
harvested from sources which had previously sought to provide 


services as wide ranging as tennis tuition. 


The Commissioner is further satisfied that SMG cannot rely on the ‘soft 
opt-in’ exemption provided by Regulation 22(3) PECR for the purposes 
of the messages sent. Whilst SMG state that data was obtained from 
several sources, it is itself a ‘software design and build consultancy’, 
and this would appear to bear no relation to the sale of personal 
protective equipment which SMG sought to conduct with its direct 


marketing messages on 30 April 2020. 


In short, SMG has provided no evidence to support a reliance on 
Regulation 22(3) PECR, or any evidence to demonstrate valid consent 


whatsoever. 


The Commissioner would also note that, upon receiving the 
Commissioner’s initial investigation letter, SMG advised her that it had 
deleted its database, and its platform provider account, essentially 
removing any chance of accurately relaying to the Commissioner the 
total volume of messages delivered to affected subscribers. As such it 
is impossible to determine the total number of individuals whose 


privacy had been impacted by the actions of SMG. 


The Commissioner has considered, as she is required to do under 
section 40(2) of the DPA (as extended and modified by PECR) when 
deciding whether to serve an Enforcement Notice, whether any 
contravention has caused or is likely to cause any person damage or 


distress. The Commissioner has decided that, given the ongoing 
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pandemic, and the nature of the direct marketing which took place, it is 


likely that damage or distress has been caused in this instance. 


26. In view of the matters referred to above the Commissioner 
hereby gives notice that, in exercise of her powers under 
section 40 of the DPA, she requires SMG to take the steps 


specified in Annex 1 of this Notice. 


Right of Appeal 


27. There is aright of appeal against this Notice to the First-tier Tribunal 
(Information Rights), part of the General Regulatory Chamber. 


Information about appeals is set out in the attached Annex 2. 


Dated the 6th day of October 2020 


Andy Curry 

Head of Investigations 
Information Commissioner’s Office 
Wycliffe House 

Water Lane 

Wilmslow 

Cheshire 

SK9 5AF 


1CO. 


Information Commissioner's Office 


ANNEX 1 


TERMS OF THE ENFORCEMENT NOTICE 


SMG shall within 30 days of the date of this notice: 


Except in the circumstances referred to in paragraph (3) of 
regulation 22 of PECR, neither transmit, nor instigate the 
transmission of, unsolicited communications for the purposes of 
direct marketing by means of electronic mail unless the recipient of 
the electronic mail has previously notified SMG that he clearly and 
specially consents for the time being to such communications being 


sent by, or at the instigation of, SMG. 
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ANNEX 2 
DATA PROTECTI ON ACT 1998 
REPRESENTATI ONS IN RESPONSE TO A PRELI MI NARY NOTI CE 


1. Section 48 of the Data Protection Act 1998 gives any person upon 
whom an enforcement notice has been served a right of appeal to the 
First-tier Tribunal (Information Rights) (the “Tribunal”) against the 


notice. 
2. If you decide to appeal and if the Tribunal considers: - 


a) that the notice against which the appeal is brought is not in 


accordance with the law; or 


b) to the extent that the notice involved an exercise of discretion by 
the Commissioner, that she ought to have exercised her 


discretion differently, 


the Tribunal will allow the appeal or substitute such other decision as 
could have been made by the Commissioner. In any other case the 


Tribunal will dismiss the appeal. 


3. You may bring an appeal by serving a notice of appeal on the Tribunal 


at the following address: 


General Regulatory Chamber 
HM Courts & Tribunals Service 
PO Box 9300 


Leicester 
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LE1 8D) 


Telephone: 0300 123 4504 


Email: grc@justice.gov.uk 


e The notice of appeal should be served on the Tribunal within 28 


days of the date on which the enforcement notice was sent 


The statutory provisions concerning appeals to the First-tier Tribunal 
(General Regulatory Chamber) are contained in sections 48 and 49 of, 
and Schedule 6 to, the Data Protection Act 1998, and Tribunal 
Procedure (First-tier Tribunal) (General Regulatory Chamber) Rules 
2009 (Statutory Instrument 2009 No. 1976 (L.20)). 
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